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DETAILED ACTION 
Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 103(a) which fornns the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1, 2, 4, 6, 16, 17, 19, 21, 30, 31, 33, and 35 are rejected under 35 U.S.C. 
103(a) as being unpatentable over US 6327677 to Garg et al. Referring to claims 1,16, 
and 30, Garg et al. disclose repeatedly reviewing monitoring statistics repeatedly 
reviewing ongoing monitoring statistics regarding operation of a server, said steps of 
reviewing being performed at least as often as a selected time period (From the abstract 
(with emphasis), "A system is provided that monitors a network environment. The 
system collects recent data associated with operation of the network environment. 
The network environment is analyzed by comparing the collected data with historical 
data associated with the operation of the network environment. The system determines 
whether a problem or a potential problem exists based on the analysis of the network 
environment. The historical data associated with the operation of the network 
environment is represented in multiple cognitive signatures. The system regularly 
updates the historical data to include the recently collected data." Further, from line 50 
of column 4, "For example, network monitor 22 can monitor the CPU performance, 
memory utilization, and application response time of workstations and servers contained 
in the network environment."); processing said monitoring statistics using a diagnostic 
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software module, in response to said steps of repeatedly reviewing (From line 3 of 
column 6, "Analysis module 38 receives collected data from data collection module 30, 
and receives one or more cognitive signatures from cognitive signature module 34. 
Analysis module 38 analyzes current performance or operation of the network 
environment by comparing the data collected via the network with the cognitive 
signatures, which represent past performance or operation of the network environment 
at similar times for similar devices, systems, or applications. Analysis module 38 may 
also compare the current data collected with one or more threshold values."); wherein 
said diagnostic software diagnoses a behavior of said file server by comparing said 
monitoring statistics to rules or patterns representing abnormal states of operation for 
said file server (From line 1 4 of column 6, "Based on the results of the analysis 
performed by analysis module 38, an alarm signal may be communicated to alarm 
generator 40." Further, from the abstract, "The network environment is analyzed by 
comparing the collected data with historical data associated with the operation of the 
network environment." While Garg does not specifically disclose using cognitive 
signatures regarding "normal" operation, by identifying what is normal, what is abnormal 
is subsequently identified as well (i.e., anything that is not normal).). Although Garg et 
al. do not specifically disclose said server can be a file server, using a server to serve 
files is well known in the art. Examiner takes official notice for file servers. A person of 
ordinary skill in the art at the time of the invention would have been motivated to use a 
server as a file server because there is a need to distribute data in a network. Wherein a 
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file server would have at least an interface to a network, mass storage accessible 
through said interface, and a processor that controls access to said mass storage. 

Referring to claims 2, 17, and 31, Garg et al. disclose said diagnostic software 
module includes a pattern matching system and a rule-based inference system (From 
line 19 of column 14, "By comparing the current data to the previous time period and the 
next time period, the procedure is able to identify a pattern or event that is shifted in 
time," Further, from line 66 of column 11, "Analyzer 1 1 0 receives current data 112, one 
or more cognitive signatures 114, one or more analysis rules 116, exception information 
118, and signature correlation factors 120."). 

Referring to claims 4, 19, and 33, Garg et al. disclose said monitoring statistics 
include information gathered by at least one software module within an operating 
system of said file server (From line 14 of column 5, "Network monitor 22 includes a 
data collection module 30 that collects information from various devices or applications, 
such as information regarding network utilization (or device utilization), lost packets, 
response time, or number of errors. Data collection module 30 collects information 
regarding the operation or performance of the network environment on one or more 
communication links 31 . Data collection module 30 can collect data from any number of 
networks and any number of network devices or applications."). 

Referring to claims 6, 21 , and 35, Garg et al. disclose said steps of processing 
are responsive to a usage profile for said file server (From the abstract, "The network 
environment is analyzed by comparing the collected data with historical data associated 
with the operation of the network environment."). 
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3. Claims 3, 18, and 32 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over US 6327677 to Garg et al. as applied to claims 1,16, and 30 above, and further in 
view of US 5920719 to Sutton et al. Referring to claims 3, 18, and 32, although Garg et 
al. do not specifically disclose information gathered by a first and second software 
module at differing levels in an operating system, such a method of information 
gathering is known in the art. An example of this is shown by Sutton et al. From the 
abstract, "Writer entities register their intent to collect and store performance information 
in the registry by creating objects, via novel API calls, as nodes organized within the 
tree structure. Each object node of the registry is named according to a convention that 
identifies the type of performance data collected by that node. Each object node further 
represents a single data item having a single data type for collecting the performance 
and a reference to the actual storage location of its collected performance information." 
Futher, from line 58 of column 5, "The reader entities 310 typically include user 
application processes 250a-c desirous of obtaining performance information from the 
registry 400, while the writer entities 320 include those processes along with operating 
system components, such as device drivers 224, configured to collect performance 
information and "write" that information to the registry." A person of ordinary skill in the 
art at the time of the invention would have been motivated to use performance 
information gathering in a method for monitoring a network because, from Garg et al.'s 
abstract, "The system collects recent data associated with operation of the network 
environment. The network environment is analyzed by comparing the collected data 
with historical data associated with the operation of the network environment." 
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4. Claims 5, 7, 20, 22, 34, and 36 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over US 6327677 to Garg et al. Referring to claims, 5, 20, and 34, Garg et 
al. disclose that information can be collected at regular intervals, from line 43 of column 
6, "Information can be collected from the various network devices and applications at 
regular time intervals, such as every five minutes. The data collection module maintains 
a table or other collection of information to identify the various network devices and 
applications from which data is collected. For each network device, the table identifies 
the parameters or performance data to be requested and the time interval between 
requests. Thus, the data collected from the network can be selective with respect to the 
network devices, applications, interfaces or communication ports within a particular 
device, and with respect to polling time intervals." Although Garg et al. does not 
specifically disclose that such an interval can be less than 1 0 seconds, Garg et al. do 
disclose that such an interval is a matter of design, "Thus, the data collected from the 
network can be selective with respect to the network devices, applications, interfaces or 
communication ports within a particular device, and with respect to polling time 
intervals." 

Referring to claims 7, 22, and 36, although Garg et al. do not specifically disclose 
said usage profile includes information regarding whether use of said file server 
includes usage as an ISP, a development environment, or a mail server, such uses for a 
file server are well known in the art. Examiner takes official notice for using a file server 
as a mail server (wherein a file is understood to be a basic unit of storage). A person of 
ordinary skill in the art at the time of the invention would have been motivated to monitor 
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a file server used as a mail server, and thus create a usage profile in the form of 
historical data, because, from the abstract, there is a need to determine "whether a 
problem or a potential problem exists based on the analysis of the network 
environment". 

5. Claims 8-1 1 , 23-26, and 37-40 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over "TCP/IP Illustrated Volume 1: The Protocols" by Stevens. Referring 
to claims 8, 23, and 37, Stevens discloses selecting a set of parameters for a first 
communication protocol (From the first bullet of page 231 , "The requesting end 
(normally called the client) sends a SYN segment specifying the port number of the 
server that the client wants to connect to, and the client's initial sequence number".); 
attempting to communicate, between a point inside a computer and a point outside said 
computer, using a second communication protocol, said second communication 
protocol making use of said first communication protocol (From page 33, "IP is the 
workhorse protocol of the TCP/IP protocol suite. All TCP, UDP, ICMP, and IGMP data 
gets transmitted as IP datagrams." That is, IP accepts packets from TCP or UDP, adds 
its own header and delivers a datagram to the data link layer protocol, using TCP, the 
first communication protocol.); using the second communication protocol to measure a 
result of said steps of attempting to communicate (IP, being part of the communication 
process, is used as part of the process of passing values, and those values must be 
encoded, decoded, modulated, demodulated, or otherwise interpreted and subsequently 
determined through measuring (ascertaining quantity) the value of data passed using it, 
in this case, at least the resultant values of the port numbers and initial sequence 
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numbers passed back and forth between client and server.); and altering said set of 
parameters, in response to said result (From page 232, "When each end sends its SYN 
to establish the connection, it chooses an initial sequence number for that connection. 
The ISN should change over time, so that each connection has a different ISN." 
Wherein altering the ISN is done in response to (at least) data passed using TCP/IP, 
and data passed using TCP/IP is a result of attempting to communicate. Further, 
actually communicating comprises an attempt to communicate.). Although Stevens 
does not specifically disclose the system is a file server, using TCP/IP to transfer files is 
well known in the art. A person of ordinary skill in the art would have been motivated to 
use TCP/IP to transfer files because it is a widely available method of transferring data 
between computers. Wherein a file server would have at least an interface to a network, 
mass storage accessible through said interface, and a processor that controls access to 
said mass storage. 

Referring to claims 9, 24, and 38, Stevens discloses said steps of altering are 
performed at least as often as a selected time period of less than ten seconds (From 
page 232, "RFC 793 [Postel 1981c] specifies that the ISN should be viewed as a 32-bit 
counter that increments by one every 4 microseconds."). 

Referring to claims 10, 25, and 39, Stevens discloses said steps of altering are 
performed repeatedly, whereby a resulting set of parameters allows substantial 
communication between said first point and said second point (From page 232, "RFC 
793 [Postel 1981c] specifies that the ISN should be viewed as a 32-bit counter that 
increments by one every 4 microseconds. The purpose in these sequence numbers is 
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to prevent packets that get delayed in tine networl< fronn being delivered later and then 
misinterpreted as part of an existing connection."). 

Referring to claims 1 1 , 26, and 40, Stevens discloses said steps of attempting to 
communicate are performed using at least one hundred different configurations of said 
set of parameters (From page 232, "How are the sequence numbers chosen? In 
4.4BSD (and most Berkeley-derived implementations) when the system is initialized the 
initial send sequence number is initialized to 1. This practice violates the Host 
Requirements RFC. (Acomment in the code acknowledges that this is wrong.) This 
variable is then incremented by 64,000 every half-second, and will cycle back to 0 about 
every 9.5 hours. (This corresponds to a counter that is incremented every 8 
microseconds, not every 4 microseconds.) Additionally, each time a connection is 
established, this variable is incremented by 64,000." Therefore, a correct 
implementation would have been twice 64,000 (128,000) every half-second. 
Alternatively, the ISN, part of the identified set of parameters port and ISN, will have 
been incremented 100 times in a span of 400 microseconds.). 
6. Claims 13-15, 27-29, and 41-43 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over US 5745669 to Hugard et al. Referring to claims 13, 27, and 41 , 
Hugard et al. disclose tracking configuration changes to a file server (From the abstract, 
"A computer utility automatically monitors changes in configuration files stored on the 
computer hard disk." Further, although Hugard et al. do not specifically disclose the 
computer is a file server, using a computer as a file server is well known in the art. 
Examiner takes official notice for file servers. A person of ordinary skill in the art at the 
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time of the invention would have been motivated to use a computer as a file server 
because there is a need to transfer data between computers. Wherein a file server 
would have at least an interface to a network, mass storage accessible through said 
interface, and a processor that controls access to said mass storage.); identifying 
changes in computer operability for said file server that indicate an error or other failure 
in said file server (From the abstract, "The recovery tool indicates to the user when 
changes are detected in the configuration files and provides the option to restore the 
configuration files to their state before they were changed if the computer system 
operates improperly." Further, see element 210 of figure 2.); relating said changes in 
said computer operability to timing of said configuration changes (From figure 2, see 
elements 200, 210, 220, 230, and 240.); and determining, in response to said steps of 
tracking and of relating, a configuration change most likely to be responsible for said 
error or other failure in said file server (From figure 2, see elements 230 and 240. 
Further, from figure 3, see elements 325 and 335.). Although Hugard et al. do not 
specifically disclose changes in computer operation are determined by monitoring 
statistics, using numerical data to quantify the state of computer operability is well 
known in the art. Examiner takes official notice for thresholding. A person of ordinary 
skill in the art at the time of the invention would have been motivated to use thresholds 
to determine computer operability because a threshold determines what is acceptable 
or normal and what is unacceptable or abnormal. 

Referring to claims 14, 28, and 42, Hugard et al. disclose including steps of 
suggesting activities to reverse said configuration changes so as to place said file 
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server in an operating state (From the abstract, "The recovery tool indicates to the user 
\Nher\ changes are detected in the configuration files and provides the option to restore 
the configuration files to their state before they were changed if the computer system 
operates improperly."). 

Referring to claims 15, 29, and 43, Hugard et al. disclose said configuration 
changes include hardware and software configuration changes (From line 16 of column 
6, "If no change (decision block 200) has occurred in configuration files since the last 
configuration backup, the system start-up operations continue through the 
AUTOEXEC.BAT file, as well-known in the art, and as represented In an action block 
205. If the check routine determines that changes have occurred in configuration files, 
the recovery tool warns the user of the changes and prompts the user to check all 
software for proper operation, as represented in an action block 210. Along with the 
warning and prompt to check all software, the recovery tool gives the user the 
opportunity to obtain more information on the recovery tool. The display screen 21 1 of 
FIG. 5 is one possible embodiment of an exemplary screen to prompt the user of 
changes to the system configuration. In summary, the condition that exists when this 
screen is displayed is if the configuration has changed, but the user has not been 
previously notified of any detected changes." Further, from figure 3, see elements 325 
and 335. Further, from the abstract, "The recovery tool also provides for monitoring of 
the CMOS memory which stores computer system operating functions and parameters. 
If possible corruption of the CMOS memory is detected, the recovery tool restores the 
contents of the CMOS to their proper state."). 
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Response to Arguments 

7. Applicant's argunnents filed 14 April 2003 have been fully considered but they are 
not persuasive. In response to Applicant's argument regarding claims 1-7 that Garg et 
al. do not disclose comparing to abnormal states, while Garg does not specifically 
disclose using cognitive signatures regarding "normal" operation, by identifying what is 
normal, what is abnormal is subsequently identified as well (i.e., anything that is not 
normal). 

Regarding Applicant's arguments regarding claims 8-1 1 and 1 3-1 5, the grounds 
of rejection have been changed. 

Conclusion 

8. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

US 5655081 to Bonnell etal. 
US 5668944 to Berry 
US 5751964 to Ordanic et al. 
US 5758071 to Burgess et al. 
US 62371 14 to Wookey et al. 
US 6496282 to Malik 

"Mastering Windows 98, Chapter 29 - Troubleshooting Your Windows 98 
Network, Overview" by Cowart 

"Peter Norton's Complete Guide to Norton SystemWorks 2.0" by Norton et al. 
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9. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Gabriel L. Chu whose telephone number is (703) 308- 
7298. The examiner can normally be reached on weekdays with alternate Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Robert W. Beausoliel, Jr. can be reached on (703) 305-9713. The fax 
phone numbers for the organization where this application or proceeding is assigned 
are (703) 746-7239 for regular communications and (703) 746-7238 for After Final 
communications. 
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Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

gc 

IVlay 29, 2003 
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